@soulofzephir/pi-skill-pentesting 1.0.2 → 1.0.5

package/skills/pentesting/tools/full-scan.ps1

@@ -1,5 +1,5 @@
-# Full Security Scan - All-in-One v2.0
-# Comprehensive security scanner combining all tools
+# Full Security Scan - All-in-One v3.0
+# Comprehensive security scanner with detailed reporting
 
 param(
     [Parameter(Mandatory=$false)]
@@ -11,10 +11,6 @@ param(
 
 $ErrorActionPreference = "Continue"
 
-# ═══════════════════════════════════════════════════════════
-# CONFIGURATION
-# ═══════════════════════════════════════════════════════════
-
 $Date = Get-Date -Format "yyyy-MM-dd"
 
 if ($Target -match "https?://") {
@@ -32,164 +28,239 @@ if (-not (Test-Path $OutputDir)) {
     New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
 }
 
-# ═══════════════════════════════════════════════════════════
-# BANNER
-# ═══════════════════════════════════════════════════════════
-
 Write-Host ""
-Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
-Write-Host "║  🛡️ FULL SECURITY SCAN v2.0                     ║" -ForegroundColor Cyan
-Write-Host "║  Target: $Domain" -ForegroundColor Cyan
-Write-Host "║  Date: $Date" -ForegroundColor Cyan
-Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Full Security Scan v3.0" -ForegroundColor Cyan
+Write-Host "  Target: $Domain" -ForegroundColor Cyan
+Write-Host "  Date: $Date" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
 Write-Host ""
 
-# ═══════════════════════════════════════════════════════════
-# PHASE 1: SECURITY HEADERS
-# ═══════════════════════════════════════════════════════════
-
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔒 PHASE 1: Security Headers" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-
 $HeaderScore = 0
 $HeaderIssues = @()
+$HeaderGood = @()
+$ExposedFiles = @()
+$OpenPorts = @()
+$CORSIssues = @()
+$FalsePositives = @()
+$TechStack = @()
+
+# PHASE 1: Headers
+Write-Host "Phase 1: Security Headers" -ForegroundColor Yellow
 
 try {
     $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 15 -ErrorAction Stop
     $Headers = $Response.Headers
+    
+    # Detect Server/Technology
+    $Server = $Headers["Server"]
+    $XPB = $Headers["X-Powered-By"]
+    $CFRay = $Response.Headers["CF-Ray"]
+    $CFCache = $Response.Headers["CF-Cache-Status"]
+    
+    if ($Server) { $TechStack += "Server: $Server" }
+    if ($XPB) { $TechStack += "X-Powered-By: $XPB" }
+    if ($CFRay) { $TechStack += "CDN: Cloudflare" }
+    if ($CFCache) { $TechStack += "CDN Cache: Active" }
+    
 } catch {
     try {
         $Response = Invoke-WebRequest -Uri ($Target -replace "^https", "http") -Method Head -TimeoutSec 15 -ErrorAction Stop
         $Headers = $Response.Headers
     } catch {
-        Write-Host "❌ Cannot connect to target" -ForegroundColor Red
+        Write-Host "Cannot connect to target" -ForegroundColor Red
         $Headers = @{}
     }
 }
 
-# HSTS
 $HSTS = $Headers["Strict-Transport-Security"]
 if ($HSTS) {
-    Write-Host "✅ HSTS: Present" -ForegroundColor Green
-    if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") { $HeaderScore += 15 } else { $HeaderScore += 8 }
+    $HeaderGood += "HSTS: Present"
+    Write-Host "  HSTS: Present" -ForegroundColor Green
+    if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") { 
+        $HeaderScore += 15 
+        $HeaderGood += "HSTS: max-age >= 1 year"
+    } elseif ($HSTS -match "max-age=\d{5,6}") {
+        $HeaderScore += 8
+        $HeaderIssues += "HSTS max-age < 1 year (recommended: 31536000)"
+    }
 } else {
-    Write-Host "❌ HSTS: Missing" -ForegroundColor Red
+    Write-Host "  HSTS: Missing" -ForegroundColor Red
     $HeaderIssues += "HSTS not implemented"
 }
 
-# CSP
 $CSP = $Headers["Content-Security-Policy"]
 if ($CSP) {
-    Write-Host "✅ CSP: Present" -ForegroundColor Green
+    $HeaderGood += "CSP: Present"
+    Write-Host "  CSP: Present" -ForegroundColor Green
     $HeaderScore += 20
-    if ($CSP -match "unsafe-inline") { $HeaderIssues += "CSP contains unsafe-inline" }
+    if ($CSP -match "unsafe-inline") { 
+        $HeaderIssues += "CSP contains 'unsafe-inline' (XSS risk)"
+        Write-Host "    Warning: Contains unsafe-inline" -ForegroundColor Yellow
+    }
+    if ($CSP -match "unsafe-eval") { 
+        $HeaderIssues += "CSP contains 'unsafe-eval'"
+    }
 } else {
-    Write-Host "❌ CSP: Missing" -ForegroundColor Red
+    Write-Host "  CSP: Missing" -ForegroundColor Red
     $HeaderIssues += "CSP not implemented (XSS risk)"
 }
 
-# X-Content-Type-Options
 $XCTO = $Headers["X-Content-Type-Options"]
 if ($XCTO -eq "nosniff") {
-    Write-Host "✅ X-Content-Type-Options: nosniff" -ForegroundColor Green
+    $HeaderGood += "X-Content-Type-Options: nosniff"
+    Write-Host "  X-Content-Type-Options: nosniff" -ForegroundColor Green
     $HeaderScore += 10
 } else {
-    Write-Host "❌ X-Content-Type-Options: Missing" -ForegroundColor Red
+    Write-Host "  X-Content-Type-Options: Missing" -ForegroundColor Red
     $HeaderIssues += "X-Content-Type-Options not set"
 }
 
-# X-Frame-Options
 $XFO = $Headers["X-Frame-Options"]
 if ($XFO -eq "DENY" -or $XFO -eq "SAMEORIGIN") {
-    Write-Host "✅ X-Frame-Options: $XFO" -ForegroundColor Green
+    $HeaderGood += "X-Frame-Options: $XFO"
+    Write-Host "  X-Frame-Options: $XFO" -ForegroundColor Green
     $HeaderScore += if ($XFO -eq "DENY") { 10 } else { 8 }
 } else {
-    Write-Host "❌ X-Frame-Options: Missing" -ForegroundColor Red
+    Write-Host "  X-Frame-Options: Missing" -ForegroundColor Red
     $HeaderIssues += "X-Frame-Options not set (clickjacking risk)"
 }
 
-# Referrer-Policy
 $RP = $Headers["Referrer-Policy"]
 if ($RP) {
-    Write-Host "✅ Referrer-Policy: $RP" -ForegroundColor Green
+    $HeaderGood += "Referrer-Policy: $RP"
+    Write-Host "  Referrer-Policy: Present" -ForegroundColor Green
     $HeaderScore += 10
 } else {
-    Write-Host "⚠️  Referrer-Policy: Missing" -ForegroundColor Yellow
+    Write-Host "  Referrer-Policy: Missing" -ForegroundColor Yellow
     $HeaderScore += 5
 }
 
-# Cache-Control
-$CC = $Headers["Cache-Control"]
-if ($CC -match "no-store|no-cache") {
-    Write-Host "✅ Cache-Control: Secure" -ForegroundColor Green
+$PP = $Headers["Permissions-Policy"]
+if ($PP) {
+    $HeaderGood += "Permissions-Policy: Present"
+    Write-Host "  Permissions-Policy: Present" -ForegroundColor Green
     $HeaderScore += 10
 } else {
-    Write-Host "⚠️  Cache-Control: Check if sensitive data cached" -ForegroundColor Yellow
+    Write-Host "  Permissions-Policy: Missing" -ForegroundColor Yellow
     $HeaderScore += 5
 }
 
-# Server
-$Server = $Headers["Server"]
-if ($Server -match "/\d|Advanced") {
-    Write-Host "⚠️  Server: Leaks version - $Server" -ForegroundColor Yellow
-    $HeaderIssues += "Server header leaks version"
+$CC = $Headers["Cache-Control"]
+if ($CC -match "no-store|no-cache|private") {
+    $HeaderGood += "Cache-Control: $CC"
+    Write-Host "  Cache-Control: $CC" -ForegroundColor Green
+    $HeaderScore += 5
+} else {
+    Write-Host "  Cache-Control: Not optimal" -ForegroundColor Yellow
+    $HeaderScore += 2
+}
+
+# Check Server for version leaks
+if ($Server -match "/\d|Apache/[0-9]|nginx/[0-9]|Microsoft-IIS/[0-9]") {
+    Write-Host "  Server: Leaks version - $Server" -ForegroundColor Yellow
+    $HeaderIssues += "Server header leaks version: $Server"
+} elseif ($Server) {
+    Write-Host "  Server: $Server" -ForegroundColor Gray
 }
 
-# X-Powered-By
-$XPB = $Headers["X-Powered-By"]
 if ($XPB) {
-    Write-Host "⚠️  X-Powered-By: $XPB" -ForegroundColor Yellow
-    $HeaderIssues += "X-Powered-By leaks technology"
+    Write-Host "  X-Powered-By: $XPB" -ForegroundColor Yellow
+    $HeaderIssues += "X-Powered-By leaks technology: $XPB"
 }
 
+# Check CORS
 Write-Host ""
-Write-Host "📊 Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+Write-Host "Phase 1b: CORS Analysis" -ForegroundColor Yellow
+
+$ACAO = $Headers["Access-Control-Allow-Origin"]
+$ACAC = $Headers["Access-Control-Allow-Credentials"]
+$ACAM = $Headers["Access-Control-Allow-Methods"]
 
-# ═══════════════════════════════════════════════════════════
-# PHASE 2: EXPOSED FILES
-# ═══════════════════════════════════════════════════════════
+if ($ACAO) {
+    Write-Host "  CORS Origin: $ACAO" -ForegroundColor $(if($ACAO -eq "*"){"Yellow"}else{"Green"})
+    if ($ACAO -eq "*") {
+        $CORSIssues += "CORS allows all origins (Access-Control-Allow-Origin: *)"
+        Write-Host "    Warning: Allows all origins" -ForegroundColor Yellow
+    }
+}
+
+if ($ACAC -eq "true" -and $ACAO -eq "*") {
+    $CORSIssues += "CORS: Wildcard with credentials (invalid but misconfigured)"
+    Write-Host "    CRITICAL: Wildcard with credentials!" -ForegroundColor Red
+}
+
+if ($ACAM) {
+    Write-Host "  CORS Methods: $ACAM" -ForegroundColor Gray
+}
 
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔍 PHASE 2: Exposed Files Check" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "  Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+
+# PHASE 2: Exposed Files
+Write-Host ""
+Write-Host "Phase 2: Exposed Files" -ForegroundColor Yellow
 
-$ExposedFiles = @()
 $CriticalPaths = @(
-    "/.env", "/.git/config", "/.git/HEAD", "/.git/",
-    "/wp-config.php", "/config.php", "/settings.py",
-    "/backup.zip", "/database.sql", "/db.sql",
-    "/admin/", "/debug/", "/phpmyadmin/", "/pma/",
-    "/actuator/env", "/actuator/heapdump",
-    "/swagger-ui/", "/graphiql/"
+    @{ Path="/.env"; Risk="CRITICAL"; Desc="Environment variables" },
+    @{ Path="/.git/config"; Risk="CRITICAL"; Desc="Git repository" },
+    @{ Path="/.git/"; Risk="CRITICAL"; Desc="Git directory" },
+    @{ Path="/config.php"; Risk="HIGH"; Desc="PHP configuration" },
+    @{ Path="/settings.py"; Risk="HIGH"; Desc="Python settings" },
+    @{ Path="/backup.zip"; Risk="CRITICAL"; Desc="Backup archive" },
+    @{ Path="/database.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/db.sql"; Risk="CRITICAL"; Desc="Database dump" },
+    @{ Path="/admin/"; Risk="HIGH"; Desc="Admin panel" },
+    @{ Path="/debug/"; Risk="HIGH"; Desc="Debug endpoint" },
+    @{ Path="/phpmyadmin/"; Risk="CRITICAL"; Desc="Database UI" },
+    @{ Path="/actuator/env"; Risk="CRITICAL"; Desc="Spring Boot env" }
 )
 
-foreach ($path in $CriticalPaths) {
+$TrueExposedFiles = @()
+$FalsePositiveFiles = @()
+
+foreach ($item in $CriticalPaths) {
     try {
-        $resp = Invoke-WebRequest -Uri "$Target$path" -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
-        if ($resp.StatusCode -ne 404) {
-            Write-Host "⚠️  FOUND: $path (HTTP $($resp.StatusCode))" -ForegroundColor Red
-            $ExposedFiles += $path
+        $resp = Invoke-WebRequest -Uri "$Target$($item.Path)" -Method Head -TimeoutSec 5 -ErrorAction SilentlyContinue
+        if ($resp.StatusCode -ne 404 -and $resp.StatusCode -ne 403) {
+            $ContentType = $resp.Headers["Content-Type"]
+            $BodyPreview = ""
+            
+            # Check if it's a real sensitive file or SPA
+            if ($ContentType -match "text/html|application/octet-stream" -and $item.Path -notmatch "\.zip|\.sql|\.env|\.git") {
+                # Check body content
+                try {
+                    $bodyResp = Invoke-WebRequest -Uri "$Target$($item.Path)" -TimeoutSec 5 -ErrorAction SilentlyContinue
+                    $BodyPreview = $bodyResp.Content.Substring(0, [Math]::Min(200, $bodyResp.Content.Length))
+                } catch {}
+                
+                if ($BodyPreview -match "root|div|html|<!" -and $BodyPreview.Length -lt 1000) {
+                    # Likely SPA false positive
+                    $FalsePositiveFiles += $item
+                    Write-Host "  [FP] $($item.Path) - HTTP $($resp.StatusCode) (likely SPA)" -ForegroundColor Gray
+                } else {
+                    # Real exposed file
+                    $TrueExposedFiles += $item
+                    Write-Host "  FOUND: $($item.Path) (HTTP $($resp.StatusCode))" -ForegroundColor Red
+                }
+            } else {
+                # Real file
+                $TrueExposedFiles += $item
+                Write-Host "  FOUND: $($item.Path) (HTTP $($resp.StatusCode))" -ForegroundColor Red
+            }
         }
     } catch {}
 }
 
-if ($ExposedFiles.Count -eq 0) {
-    Write-Host "✅ No critical files exposed" -ForegroundColor Green
+if ($TrueExposedFiles.Count -eq 0) {
+    Write-Host "  No sensitive files exposed" -ForegroundColor Green
 }
 
-# ═══════════════════════════════════════════════════════════
-# PHASE 3: PORT CHECK
-# ═══════════════════════════════════════════════════════════
-
+# PHASE 3: Port Check
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔌 PHASE 3: Quick Port Check" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "Phase 3: Port Check" -ForegroundColor Yellow
 
 $Ports = @(80, 443, 8080, 3306, 5432, 6379, 27017, 22)
-$OpenPorts = @()
 
 foreach ($Port in $Ports) {
     try {
@@ -198,311 +269,202 @@ foreach ($Port in $Ports) {
         $Wait = $Result.AsyncWaitHandle.WaitOne(500)
         
         if ($Wait -and $TCP.Connected) {
-            $Service = switch ($Port) {
-                80 { "HTTP" }
-                443 { "HTTPS" }
-                8080 { "HTTP-Alt" }
-                3306 { "MySQL" }
-                5432 { "PostgreSQL" }
-                6379 { "Redis" }
-                27017 { "MongoDB" }
-                22 { "SSH" }
-            }
-            $Risk = if ($Port -in @(3306, 5432, 6379, 27017)) { "HIGH" } else { "INFO" }
-            
-            Write-Host "⚠️  Port $Port ($Service) - OPEN" -ForegroundColor $(if($Risk -eq "HIGH"){"Red"}else{"Yellow"})
-            $OpenPorts += [PSCustomObject]@{ Port = $Port; Service = $Service; Risk = $Risk }
+            $Service = switch ($Port) { 80{"HTTP"} 443{"HTTPS"} 8080{"HTTP-Alt"} 3306{"MySQL"} 5432{"PostgreSQL"} 6379{"Redis"} 27017{"MongoDB"} 22{"SSH"} }
+            $Risk = if ($Port -in @(3306,5432,6379,27017)) { "HIGH" } else { "INFO" }
+            Write-Host "  Port $Port ($Service) - OPEN" -ForegroundColor $(if($Risk -eq "HIGH"){"Red"}else{"Gray"})
+            $OpenPorts += [PSCustomObject]@{ Port=$Port; Service=$Service; Risk=$Risk }
         }
         $TCP.Close()
     } catch {}
 }
 
-if ($OpenPorts.Count -eq 0) {
-    Write-Host "✅ No common ports detected" -ForegroundColor Green
-}
-
-# ═══════════════════════════════════════════════════════════
-# PHASE 4: BASIC INJECTION TEST
-# ═══════════════════════════════════════════════════════════
-
+# PHASE 4: Injection Tests
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "💉 PHASE 4: Basic Injection Tests" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "Phase 4: Injection Tests" -ForegroundColor Yellow
 
-# XSS Test
-Write-Host "Testing XSS..." -ForegroundColor Gray
 $XSSPayload = "<script>alert(1)</script>"
 try {
     $Response = Invoke-WebRequest -Uri "$Target/search?q=$XSSPayload" -TimeoutSec 10 -ErrorAction SilentlyContinue
     if ($Response.Content -match [regex]::Escape($XSSPayload)) {
-        Write-Host "⚠️  Possible XSS reflection detected" -ForegroundColor Yellow
+        Write-Host "  XSS: Possible reflection detected" -ForegroundColor Yellow
     } else {
-        Write-Host "✅ No obvious XSS reflection" -ForegroundColor Green
+        Write-Host "  XSS: No obvious reflection" -ForegroundColor Green
     }
-} catch {
-    Write-Host "✅ No obvious XSS reflection" -ForegroundColor Green
-}
+} catch { Write-Host "  XSS: No obvious reflection" -ForegroundColor Green }
 
-# SQLi Test
-Write-Host "Testing SQL Injection..." -ForegroundColor Gray
 $SQLPayload = "' OR '1'='1"
 try {
     $Response = Invoke-WebRequest -Uri "$Target/?id=$SQLPayload" -TimeoutSec 10 -ErrorAction SilentlyContinue
-    $SQLErrors = @("SQL syntax", "MySQL", "PostgreSQL", "sqlite", "Microsoft SQL", "Warning: mysql", "error in your SQL")
+    $SQLErrors = @("SQL syntax","MySQL","PostgreSQL","sqlite","Microsoft SQL","Warning: mysql")
     $Found = $SQLErrors | Where-Object { $Response.Content -match $_ }
     if ($Found) {
-        Write-Host "⚠️  SQL error detected in response" -ForegroundColor Yellow
+        Write-Host "  SQLi: Error detected" -ForegroundColor Yellow
     } else {
-        Write-Host "✅ No obvious SQL errors" -ForegroundColor Green
+        Write-Host "  SQLi: No obvious errors" -ForegroundColor Green
     }
-} catch {
-    Write-Host "✅ No obvious SQL errors" -ForegroundColor Green
-}
-
-# ═══════════════════════════════════════════════════════════
-# PHASE 5: SSL/TLS CHECK
-# ═══════════════════════════════════════════════════════════
+} catch { Write-Host "  SQLi: No obvious errors" -ForegroundColor Green }
 
+# PHASE 5: SSL Check
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "🔐 PHASE 5: SSL/TLS Check" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-
-$SSLIssues = @()
+Write-Host "Phase 5: SSL/TLS Check" -ForegroundColor Yellow
 
 if ($Scheme -eq "https") {
-    Write-Host "✅ HTTPS enabled" -ForegroundColor Green
-    
-    # Check HSTS
-    if ($HSTS -notmatch "max-age=([3-9]\d{5,}|\d{7,})") {
-        Write-Host "⚠️  HSTS max-age should be at least 1 year" -ForegroundColor Yellow
-        $SSLIssues += "HSTS max-age too short"
-    }
-    
-    Write-Host "📝 For full SSL analysis: https://ssllabs.com/ssltest/analyze.html?d=$Domain" -ForegroundColor Cyan
+    Write-Host "  HTTPS: Enabled" -ForegroundColor Green
 } else {
-    Write-Host "❌ HTTPS not enforced" -ForegroundColor Red
-    $SSLIssues += "HTTPS not enabled"
+    Write-Host "  HTTPS: NOT enforced" -ForegroundColor Red
 }
 
-# ═══════════════════════════════════════════════════════════
 # SUMMARY
-# ═══════════════════════════════════════════════════════════
-
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
-Write-Host "📊 SCAN SUMMARY" -ForegroundColor Cyan
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  SCAN SUMMARY" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
 Write-Host ""
+Write-Host "Header Score:  $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+Write-Host "True Exposed:  $($TrueExposedFiles.Count)" -ForegroundColor $(if($TrueExposedFiles.Count -gt 0){"Red"}else{"Green"})
+Write-Host "False Positives: $($FalsePositiveFiles.Count)" -ForegroundColor Gray
+Write-Host "Open Ports:    $($OpenPorts.Count)" -ForegroundColor $(if(($OpenPorts | Where-Object{$_.Risk -eq "HIGH"}).Count -gt 0){"Red"}else{"Green"})
+
+# Determine Overall Risk
+$CriticalPorts = ($OpenPorts | Where-Object { $_.Risk -eq "HIGH" }).Count
+$OverallRisk = if ($TrueExposedFiles.Count -gt 0 -or $CriticalPorts -gt 2 -or $HeaderScore -lt 40) { "HIGH" }
+              elseif ($TrueExposedFiles.Count -gt 0 -or $CriticalPorts -gt 0 -or $CORSIssues.Count -gt 0) { "MEDIUM" }
+              elseif ($HeaderScore -lt 70 -or $FalsePositiveFiles.Count -gt 0) { "LOW" }
+              else { "LOW" }
+
+# Generate Report
+$HeaderGrade = if ($HeaderScore -ge 90) { "A - Excellent" }
+               elseif ($HeaderScore -ge 80) { "B - Good" }
+               elseif ($HeaderScore -ge 70) { "B - Good" }
+               elseif ($HeaderScore -ge 50) { "C - Needs Improvement" }
+               else { "D/F - Poor" }
+
+$IssuesSection = if ($HeaderIssues.Count -gt 0) { "- " + ($HeaderIssues -join "`n- ") } else { "None" }
+
+$ExposedSection = ""
+if ($TrueExposedFiles.Count -gt 0) {
+    $ExposedSection = "| Path | Status | Risk | Description |`n"
+    $ExposedSection += "|------|--------|------|-------------|`n"
+    foreach ($f in $TrueExposedFiles) {
+        $ExposedSection += "| $($f.Path) | OPEN | $($f.Risk) | $($f.Desc) |`n"
+    }
+} else {
+    $ExposedSection = "No sensitive files actually exposed."
+}
 
-Write-Host "🔒 Header Score:  $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
-Write-Host "🔍 Exposed Files: $($ExposedFiles.Count)" -ForegroundColor $(if($ExposedFiles.Count -gt 0){"Yellow"}else{"Green"})
-Write-Host "🔌 Open Ports:    $($OpenPorts.Count)" -ForegroundColor $(if(($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0){"Red"}else{"Green"})
-Write-Host "💉 Injection:     Basic tests completed" -ForegroundColor Green
-Write-Host "🔐 SSL/TLS:       HTTPS $($SSLIssues.Count -eq 0 ? 'OK' : 'Issues')" -ForegroundColor $(if($SSLIssues.Count -eq 0){"Green"}else{"Yellow"})
+$FalsePOSection = ""
+if ($FalsePositiveFiles.Count -gt 0) {
+    $FalsePOSection = "### False Positives (Not Real Issues)`n`n"
+    $FalsePOSection += "These paths returned HTML/SPA content, not actual sensitive files:`n`n"
+    foreach ($f in $FalsePositiveFiles) {
+        $FalsePOSection += "- $($f.Path) - HTTP 200 (SPA routing)`n"
+    }
+    $FalsePOSection += "`n"
+}
 
-# ═══════════════════════════════════════════════════════════
-# GENERATE REPORT
-# ═══════════════════════════════════════════════════════════
+$CORSSection = ""
+if ($CORSIssues.Count -gt 0) {
+    $CORSSection = "### CORS Issues`n`n"
+    foreach ($c in $CORSIssues) {
+        $CORSSection += "- $c`n"
+    }
+    $CORSSection += "`n"
+}
 
-Write-Host ""
-Write-Host "📝 Generating detailed report..." -ForegroundColor Yellow
+$PortSection = ""
+if ($OpenPorts.Count -gt 0) {
+    $PortSection = "| Port | Service | Risk |`n|------|---------|------|`n"
+    foreach ($p in $OpenPorts) {
+        $PortSection += "| $($p.Port) | $($p.Service) | $($p.Risk) |`n"
+    }
+} else {
+    $PortSection = "No common ports detected.`n"
+}
+
+$Remediation = @()
+if ($TrueExposedFiles.Count -gt 0) { $Remediation += "1. **URGENT: Remove exposed sensitive files**" }
+if ($CORSIssues.Count -gt 0) { $Remediation += "2. Review CORS policy" }
+if ($HeaderIssues -match "unsafe-inline") { $Remediation += "3. Consider removing unsafe-inline from CSP" }
+if ($HeaderScore -lt 70) { $Remediation += "4. Improve security headers" }
+if ($Remediation.Count -eq 0) { $Remediation += "1. Continue monitoring security" }
+
+$TechSection = if ($TechStack.Count -gt 0) { "- " + ($TechStack -join "`n- ") } else { "Not detected" }
 
 $Report = @"
-# 🛡️ Full Security Audit Report
+# Security Audit Report
 
 **Target:** $Target
 **Domain:** $Domain
 **Date:** $Date
-**Scanner:** Full Security Scan v2.0
+**Scanner:** Full Security Scan v3.0
+**Author:** Rz (@soulofzephir)
 
 ---
 
-## 📋 Executive Summary
+## Executive Summary
 
 | Metric | Value |
 |--------|-------|
-| Target | $Target |
-| Scan Date | $Date |
-| Header Score | $HeaderScore/100 |
-| Exposed Files | $($ExposedFiles.Count) |
+| Header Score | $HeaderScore/100 ($HeaderGrade) |
+| True Exposed Files | $($TrueExposedFiles.Count) |
+| False Positives | $($FalsePositiveFiles.Count) |
 | Open Ports | $($OpenPorts.Count) |
-| SSL Issues | $($SSLIssues.Count) |
-
-### Overall Risk Assessment
-
-$(if ($HeaderScore -lt 50 -or $ExposedFiles.Count -gt 0 -or ($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0) {
-    "🔴 **HIGH RISK** - Issues found requiring immediate attention"
-} elseif ($HeaderScore -lt 70 -or $ExposedFiles.Count -gt 0) {
-    "🟠 **MEDIUM RISK** - Some security improvements recommended"
-} else {
-    "🟢 **LOW RISK** - Minor issues to address"
-})
+| **Overall Risk** | **$OverallRisk** |
 
 ---
 
-## 🔒 1. Security Headers Analysis
+## Security Headers
 
-### Header Score: $HeaderScore/100
+### Score: $HeaderScore/100 ($HeaderGrade)
 
-$(if ($HeaderScore -ge 90) { "✅ **Grade A - Excellent**" }
-elseif ($HeaderScore -ge 70) { "✅ **Grade B - Good**" }
-elseif ($HeaderScore -ge 50) { "⚠️ **Grade C - Needs Improvement**" }
-else { "❌ **Grade D/F - Poor**" })
+#### Good Headers
+$($HeaderGood -join "`n")
 
-| Header | Status |
-|--------|--------|
-| HSTS | $(if ($HSTS) { "✅ Present" } else { "❌ Missing" }) |
-| CSP | $(if ($CSP) { "✅ Present" } else { "❌ Missing" }) |
-| X-Content-Type-Options | $(if ($XCTO -eq "nosniff") { "✅ nosniff" } else { "❌ Missing" }) |
-| X-Frame-Options | $(if ($XFO) { "✅ $XFO" } else { "❌ Missing" }) |
-| Referrer-Policy | $(if ($RP) { "✅ Present" } else { "⚠️ Missing" }) |
-| Cache-Control | $(if ($CC) { "✅ Present" } else { "⚠️ Missing" }) |
-| Server | $(if ($Server) { "⚠️ $Server" } else { "✅ Hidden" }) |
-| X-Powered-By | $(if ($XPB) { "⚠️ $XPB" } else { "✅ Hidden" }) |
-
-### Issues Found
-
-$(if ($HeaderIssues.Count -gt 0) {
-    foreach ($issue in $HeaderIssues) {
-        "- ⚠️  $issue"
-    }
-} else {
-    "✅ No major header issues"
-})
+#### Issues Found
+$IssuesSection
 
 ---
 
-## 🔍 2. Exposed Files Check
+## Exposed Files
 
-$(if ($ExposedFiles.Count -gt 0) {
-    "### 🚨 Found $($ExposedFiles.Count) Exposed Files"
-} else {
-    "### ✅ No Critical Files Exposed"
-})
-
-| Path | Risk |
-|------|------|
-$(foreach ($file in $ExposedFiles) {
-    "| $file | 🔴 CRITICAL |"
-})
-
-**Recommendation:** Remove or protect these files from public access.
+### True Exposures
+$ExposedSection
 
+$FalsePOSection
+## CORS Analysis
+$CORSSection
+## Port Scan Results
+$PortSection
+## Technology Stack
+$TechSection
 ---
 
-## 🔌 3. Port Scan Results
-
-$(if (($OpenPorts | Where-Object {$_.Risk -eq "HIGH"}).Count -gt 0) {
-    "### 🚨 High-Risk Ports Open"
-} else {
-    "### ✅ No High-Risk Ports Detected"
-})
-
-| Port | Service | Risk |
-|------|---------|------|
-$(foreach ($p in $OpenPorts) {
-    "| $($p.Port) | $($p.Service) | $(if($p.Risk -eq "HIGH"){"🔴 HIGH"}else{"🟢 INFO"}) |"
-})
+## Remediation
 
-**Recommendation:** Database ports (3306, 5432, 6379, 27017) should never be exposed to the internet.
+$(if ($Remediation.Count -gt 0) { $Remediation -join "`n" })
 
 ---
 
-## 💉 4. Injection Tests
-
-Basic automated tests completed.
+## Quick Links
 
-| Test | Status |
-|------|--------|
-| XSS Reflection | ⚠️ Review manually |
-| SQL Injection | ⚠️ Review manually |
-
-**Note:** For comprehensive injection testing, use:
-- SQLMap: \`sqlmap -u "$Target"\`
-- Dalfox: \`dalfox url "$Target"\`
+- Security Headers: https://securityheaders.com/?q=$Domain
+- SSL Labs: https://ssllabs.com/ssltest/analyze.html?d=$Domain
 
 ---
 
-## 🔐 5. SSL/TLS
-
-$(if ($Scheme -eq "https") {
-    "✅ HTTPS is enabled"
-} else {
-    "❌ HTTPS is NOT enabled"
-})
-
-$(if ($SSLIssues.Count -gt 0) {
-    "### ⚠️ SSL Issues:"
-    foreach ($issue in $SSLIssues) {
-        "- $issue"
-    }
-})
-
-**Full SSL Analysis:** https://ssllabs.com/ssltest/analyze.html?d=$Domain
-
----
-
-## 🛡️ Remediation Priority
-
-### Immediate (Critical)
-1. Implement missing security headers
-2. Remove/block exposed sensitive files (.env, .git/, backups)
-3. Close database ports from public access
-
-### Short-term
-1. Enable HSTS with long max-age
-2. Configure Content-Security-Policy
-3. Set up proper Cache-Control
-4. Hide server information
-
-### Long-term
-1. Regular security scanning
-2. Implement OWASP Top 10 controls
-3. Set up monitoring and alerting
-4. Security headers automated testing
-
----
-
-## 🔗 Recommended Tools for Deeper Analysis
-
-| Tool | Purpose |
-|------|---------|
-| Nuclei | Vulnerability scanning |
-| SQLMap | SQL injection testing |
-| Dalfox | XSS scanning |
-| Nmap | Full port scan |
-| testssl.sh | SSL/TLS audit |
-| Burp Suite | Web vulnerability testing |
-
----
-
-## 📄 Report Location
-
-**File:** \`$OutputFile\`
-**Generated:** $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
-**Author:** Rz (@soulofzephir)
-
----
-
-**⚠️ Disclaimer:** This is an automated scan. Manual testing recommended for comprehensive security assessment.
+**Generated:** $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
 "@
 
 $Report | Out-File -FilePath $OutputFile -Encoding UTF8
 
-# ═══════════════════════════════════════════════════════════
-# COMPLETE
-# ═══════════════════════════════════════════════════════════
-
 Write-Host ""
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Green
-Write-Host "✅ FULL SCAN COMPLETE!" -ForegroundColor Green
-Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Green
+Write-Host "========================================" -ForegroundColor Green
+Write-Host "  Scan Complete!" -ForegroundColor Green
+Write-Host "========================================" -ForegroundColor Green
 Write-Host ""
-Write-Host "📄 Report: $OutputFile" -ForegroundColor White
+Write-Host "Report: $OutputFile" -ForegroundColor White
 Write-Host ""
-Write-Host "🔗 Quick Links:" -ForegroundColor Cyan
-Write-Host "   Headers: https://securityheaders.com/?q=$Domain"
-Write-Host "   SSL:     https://ssllabs.com/ssltest/analyze.html?d=$Domain"
+Write-Host "Quick Links:" -ForegroundColor Cyan
+Write-Host "  Headers: https://securityheaders.com/?q=$Domain"
+Write-Host "  SSL:     https://ssllabs.com/ssltest/analyze.html?d=$Domain"
 Write-Host ""